[PATCH] usb: gadget: u_audio: read period size while holding stream lock

[PATCH] usb: gadget: u_audio: read period size while holding stream lock

[Yaohan Li]

u_audio_iso_complete() reads the PCM runtime while holding the
substream lock, but calls snd_pcm_lib_period_bytes() after dropping
that lock. A concurrent close can detach and free the runtime in
between, causing a use-after-free when the completion callback reads
the period size.

Calculate the period size while the stream lock is held and use the
saved value after unlocking. This removes the unprotected second
runtime access without changing the period-notification condition.

KASAN reported the use-after-free in u_audio_iso_complete() on the
unmodified kernel. An injection-assisted test stopped the fixed
callback at the protected read while a concurrent close ran; no
use-after-free was reported under that test.

Fixes: 773e53d50e227 ("usb: gadget: u_audio: remove cached period bytes value")
Assisted-by: ZCode:GLM-4
Signed-off-by: Yaohan Li <shunsheng1218@gmail.com>
---
 drivers/usb/gadget/function/u_audio.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/gadget/function/u_audio.c b/drivers/usb/gadget/function/u_audio.c
index f0ee83abcebc7..7f378858146a1 100644
--- a/drivers/usb/gadget/function/u_audio.c
+++ b/drivers/usb/gadget/function/u_audio.c
@@ -156,6 +156,7 @@ static void u_audio_iso_complete(struct usb_ep *ep, struct usb_request *req)
 	struct uac_rtd_params *prm = req->context;
 	struct snd_uac_chip *uac = prm->uac;
 	unsigned int frames, p_pktsize;
+	unsigned int period_bytes;
 	unsigned long long pitched_rate_mil, p_pktsize_residue_mil,
 			residue_frames_mil, div_result;
 
@@ -267,9 +268,10 @@ static void u_audio_iso_complete(struct usb_ep *ep, struct usb_request *req)
 	/* update hw_ptr after data is copied to memory */
 	prm->hw_ptr = (hw_ptr + req->actual) % runtime->dma_bytes;
 	hw_ptr = prm->hw_ptr;
+	period_bytes = snd_pcm_lib_period_bytes(substream);
 	snd_pcm_stream_unlock(substream);
 
-	if ((hw_ptr % snd_pcm_lib_period_bytes(substream)) < req->actual)
+	if ((hw_ptr % period_bytes) < req->actual)
 		snd_pcm_period_elapsed(substream);
 
 exit:
-- 
2.34.1